Procedure examples

MegaCortex loads injecthelper.dll into a newly created rundll32.exe process.

MegaCortex has used .cmd scripts on the victim's system.

MegaCortex can parse the available drives and directories to determine which files to encrypt.

After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.

MegaCortex has added entries to the Registry for ransom contact information.

MegaCortex can enable SeDebugPrivilege and adjust token privileges.

MegaCortex has used a Base64 key to decode its components.

MegaCortex has used rundll32.exe to load a DLL for file encryption.

MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.

MegaCortex can stop and disable services on the system.

MegaCortex has deleted volume shadow copies using vssadmin.exe.

MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.

MegaCortex has changed user account passwords and logged users off the system.

MegaCortex can wipe deleted data from all drives using cipher.exe.

MegaCortex has used code signing certificates issued to fake companies to bypass security controls.

MegaCortex was used to kill endpoint security processes.